class_docstr: Class to retrieve IOCs from ThreatStream.com and store them in DynamoDB
docstr: Process URL before making API call
  Args:
      event (dict): Contains lambda function invocation information. Initially,
          Threat Intel Downloader lambda funciton is invoked by Cloudwatch
          event. 'next_url' key will be inserted to event lambda function
          invokes itself to retrieve more IOCs.
  
  Returns:
      (tuple): (list, str, bool)
          - First object is a list of intelligence.
          - Second object is a string of next token to retrieve more IOCs.
          - Third object is bool to indicated if retrieve more IOCs from
              threat feed.
docstr_tok: ["Process","URL","before","making","API","call","Args",":","event","(","dict",")",":","Contains","lambda","function","invocation","information",".","Initially",",","Threat","Intel","Downloader","lambda","funciton","is","invoked","by","Cloudwatch","event",".","'next_url","'","key","will","be","inserted","to","event","lambda","function","invokes","itself","to","retrieve","more","IOCs",".","Returns",":","(","tuple",")",":","(","list",",","str",",","bool",")","-","First","object","is","a","list","of","intelligence",".","-","Second","object","is","a","string","of","next","token","to","retrieve","more","IOCs",".","-","Third","object","is","bool","to","indicated","if","retrieve","more","IOCs","from","threat","feed","."]
code: def runner(self, event):
      """Process URL before making API call
      Args:
          event (dict): Contains lambda function invocation information. Initially,
              Threat Intel Downloader lambda funciton is invoked by Cloudwatch
              event. 'next_url' key will be inserted to event lambda function
              invokes itself to retrieve more IOCs.
  
      Returns:
          (tuple): (list, str, bool)
              - First object is a list of intelligence.
              - Second object is a string of next token to retrieve more IOCs.
              - Third object is bool to indicated if retrieve more IOCs from
                  threat feed.
      """
      event = event or {}
  
      self._load_api_creds()
  
      query = '(status="{}")+AND+({})+AND+NOT+({})'.format(
          self._IOC_STATUS,
          "+OR+".join(
              ['type="{}"'.format(ioc) for ioc in self.ioc_types]
          ),
          "+OR+".join(
              [
                  'itype="{}"'.format(itype)
                  for itype in self.excluded_sub_types
              ]
          ),
      )
      next_url = event.get(
          "next_url",
          "/api/v2/{}/?username={}&api_key={}&limit={}&q={}".format(
              self._API_RESOURCE,
              self.api_user,
              self.api_key,
              self._API_MAX_LIMIT,
              query,
          ),
      )
  
      self._connect(next_url)
  
imports: from datetime import datetime, timedelta
  import json
  import backoff
  import boto3
  from botocore.exceptions import ClientError
  import requests
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.config import load_config, parse_lambda_arn
  from streamalert.shared.logger import get_logger
  from streamalert.threat_intel_downloader.exceptions import ThreatStreamCredsError, ThreatStreamLambdaInvokeError, ThreatStreamRequestsError
label_desc: Use image node_id 10 for calling the ThreatStream obj's underlying member method code with example usage: obj.runner(event) without return types